... and now we can SPL "(?<foo>s[hi]{2}t)" Mary Cordova @cyphoid_mary ShellCon 2020
Something(s) about Mary • Splunk Trust Member, Splunk Certified Architect • SIEM 2013-16 @ <insert biggest gaming company you can think of here> • SOAR 2016-18 @ <insert Hollywood agency for your favorite A-lister here> • IR 2019-present @ <insert your 2 nd favorite (or maybe 3 rd ) comic book movie studio here> • Creds SANS GIAC 6 , CCNA, SSCP, ISC 2 Exam Developer • Education B.S. Computer Information Systems • Groups WSC, DC310, ISSA, … 2
Agenda • What is a SIEM? • Why/how is it used? • How can you get started? • Process • Common problems • Extra Resources • Assumptions • you probably already have some familiarity w/ Security, SIEM, SOC, IR, data, Splunk 3
a SIEM has (logs) : a SIEM does: 4
Splunk Enterprise Security SIEM 5
Custom Incident Response Dashboard 6
Should you put your Splunk training data in Splunk? • free courses offered by Splunk • Is it machine data with events of interest • fundamentals 1 if you’re mostly a during an incident? user/searcher/data person • Are there events that should be monitored because they indicate something bad could be happening? • Does your data provide context that could be useful in an investigation? -------------------------------------- • You have your data in Splunk...now what?! 7
Process • Find your data • Clean/normalize your data • Save “base” searches • Develop analytics, reports, dashboards, alerts 8
Finding your data index=?? sourcetype=?? • Choose something unique from your data source that you can search for in Splunk • After we have located our data we can: • Something you can generate OR • Clean our data ↗↘ something that you know (not think) already • Build a base search ↖↙ occurred • Develop analytics ↙ • We will keyword search for the generated • Getting a good base search can take time, locating data “pretty please” frequently a full days’ worth of work at least • index=* sourcetype=* keyword and often more • alternatively, if you know something of the architecture | tstats count WHERE index=* by index sourcetype • Found your data? • Immediately stop using index=* sourcetype=* 9
Building your SPL* *Search Processing Language • Incrementally define your search • Don’t start with fancy SPL • Start with “keyword” searches then • Don’t restrict your search with fields build faster indexed “field” searches at first • As you narrow the scope of the data • Don’t run it over a large time range you can expand your time window • Start with “Verbose Mode” • “ctrl+\” for nice formatting 10
Cleaning/normalizing your data • Iterate removing noise from the data using “| fields - field field field … ” • Normalize remaining fields (and values where appropriate) with CIM (Common Information Model) • src_ip =#.#.#.# • “source_ip” or “source_address” or “src_address” etc • src_mac= aa:bb:cc:00:11:22 • not “AA-BB-CC-00-11-22” or “aabbcc001122” etc • You should end up with a nice list of normalized 10-20 fields with the most important values in your data • This is a good base search that can be used over and over for various analytics 11
The Admin Guide for your data source can help Gotchas you identify fields to group different types of events so that you can work on smaller logically similar sets of data one at a time • Starting small with a keyword You need several samples of each type of event so that you no only have representation of the different makes the job manageable but types but the different data values that can be found is not comprehensive enough in each of those types to make assumptions about the broader data set • initially we get ~25 good fields for further normalization • We removed ~60 fields full of noise • Removing our keyword to get a sample of all data within our time range is an ugly surprise O_o 12
If you’re cleaning, don’t worry about your SPL’ing • Whoa … that search looks terrible!!! • Too many |fields and too many |table commands!!! • Don’t worry about that right now, you’re just cleaning up and organizing our data, you’ll clean up and organize your SPL next ↙ ↙ ↙ 13
Base search - one more time for the crowd in the back • Don’t start with fancy SPL • Do build your SPL up line by line • Don’t restrict your search with fields at • Keywords become field=value pairs first • Less keyword and more field=value • Don’t run it over a large time range means you can search larger time • Start with “Verbose Mode” ranges • Add normalization to well scoped • Incrementally define your search base searches • Start with “keyword” searches then • Save base searches for all your data build indexed “field” searches sets • As you narrow the scope of the data • Use base searches to build analytics you can expand your time window • Run finalized analytics in “Fast Mode” • “ctrl+\” for nice formatting 14
Common problems • hey Mary, my search isn’t • hey Mary, how do I know which working! fields to use? • duplicate tab • go back to slide 9-13 • delete all your lines • build slide 6 unless you like doing the same thing over and over • add lines ONE by ONE , run your search • inspect the output of the fields that aren’t doing what you want 15
Thanks!!! • This wasn’t really finished, hope it went ok! • If you’re weak on regular expressions pick up “Sams Teach Yourself Regular Expressions in 10 Minutes” • you can get by with only reading like half the book and using the quick guide in the back :D 16
Recommend
More recommend
